forceai_params you register; the lifecycle below is the same for all
The lifecycle
Every agent follows create, approve, invoke1
Create
POST /v1/agents with the agent name, an A2A agent card, and backend-specific forceai_params. The agent lands in pending, and a virtual key scoped to it is auto-provisioned2
Approve
POST /v1/agents/{agent_id}/approve. Approval is a required governance step: even an admin must approve an agent before it can be invoked, so “who approved this” stays an auditable answer. On docker-compose, reload or restart the gateway after approval so its in-memory registry picks the agent up3
Invoke
POST /v1/a2a/{agent_id}/message/send with a JSON-RPC message/send body. The gateway resolves auth, calls the backend, and logs the requestCreate request shape
Invoke request shape
result.artifacts[].parts[].text. Use method: "message/stream" for streaming backends
The backends
Snowflake Cortex
REST bridge to a Cortex Agent, PAT or key-pair JWT
AWS Bedrock AgentCore
Native A2A runtime, AWS SigV4
Microsoft 365 Copilot
Native A2A server, Entra OAuth
After an agent is live
The agent-scoped key auto-provisioned on create is how a consumer calls it. Invocations appear in Logs attributed to the agent’s real backend provider (a Cortex agent reads assnowflake, an AgentCore agent as bedrock), and each row records the backend so history keeps its attribution even after an agent is deleted